Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-57857 The Flow Payment plugin for WordPress (http://flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handle… https://www.cve.org/CVERecord?id=CVE-2026-57857
Post summary
The Flow Payment plugin for WordPress 3.0.8 is reported as having a reflected XSS flaw on the WooCommerce checkout page, as disclosed in CVE‑2026‑57857.
🚨*CVE* CVE-2026-57857 The Flow Payment plugin for WordPress (http://flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handle… https://www.cve.org/CVERecord?id=CVE-2026-57857 ----- Traducción: CV… http://infoflow.cloud`
Post summary
CVE‑2026‑57857 discloses a reflected XSS flaw in Flow Payment plugin v3.0.8 affecting the WooCommerce checkout page.